CVE-2026-107793

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-09

Assigner: VulnCheck

Description

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107793

EUVD

EUVD-2026-95350

Affected Vendors & Products

Vendor	Product	Version / Range
banq	jivejdon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Jivejdon through version 5.0 has an authorization bypass flaw in the SubscriptionServiceImp.deleteSubscription function. This allows authenticated users to delete other users' subscriptions by providing another user's subscription ID. Attackers can exploit this by sending a delete request to /account/protected/sub/subSaveAction with a different user's subscription ID to remove their thread, forum, tag, or account subscriptions.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /account/protected/sub/subSaveAction for DELETE operations with a subscriptionId parameter. Check application logs for unauthorized subscription deletions or unusual user activity patterns.

Impact Analysis

If you use Jivejdon, an attacker with access to your account could delete your subscriptions, causing you to lose track of important threads, forums, or tags. This disrupts your workflow and may lead to missed updates or information.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to delete another user's subscriptions, which may involve sensitive data. Unauthorized deletion of subscriptions could lead to data integrity issues or unintended loss of access to critical information, violating principles of data protection and availability required by these regulations.

Mitigation Strategies

Implement proper authorization checks in SubscriptionServiceImp.deleteSubscription to ensure users can only delete their own subscriptions. Validate user permissions before processing delete requests to /account/protected/sub/subSaveAction.

Hi! I’m here to help you understand CVE-2026-107793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70